From 60f98756c4dee7cbe08fc68a82d50167537a3da4 Mon Sep 17 00:00:00 2001 From: ryan Date: Sat, 15 Aug 2026 13:29:07 +0200 Subject: [PATCH] Point auth references at charon.sticknife.com auth.sticknife.com moved to charon.sticknife.com. Rather than swapping the hostname in each place, derive the OIDC issuer and the logout fallback from AUTH_BASE_URL so the auth host is configured in one place. Backend routes using charon.potternet.lan are unchanged; that internal name remains the preferred route. Co-Authored-By: Claude Opus 5 --- app/config.py | 10 ++++++---- app/oidc.py | 2 +- app/templates/landing.html | 2 +- app/templates/pantheon/charon.toml | 2 +- 4 files changed, 9 insertions(+), 7 deletions(-) diff --git a/app/config.py b/app/config.py index 01e0ac5..d2f0b51 100644 --- a/app/config.py +++ b/app/config.py @@ -82,11 +82,13 @@ def get_config() -> Config: database_url = os.environ.get("DATABASE_URL", "") if role != "home" and not database_url: raise SystemExit("DATABASE_URL is required unless APP_ROLE=home") + # Where the pages this deployment does not serve actually live. A "full" deployment serves + # them itself, so its own base URL is the right answer. The OIDC issuer defaults to the same + # host, so moving the auth service means changing AUTH_BASE_URL alone. + auth_base_url = os.environ.get("AUTH_BASE_URL", base_url).rstrip("/") return Config( role=role, - # Where the pages this deployment does not serve actually live. A "full" deployment serves - # them itself, so its own base URL is the right answer. - auth_base_url=os.environ.get("AUTH_BASE_URL", base_url).rstrip("/"), + auth_base_url=auth_base_url, base_url=base_url, host=os.environ.get("APP_HOST", "127.0.0.1"), port=int(os.environ.get("APP_PORT", "8080")), @@ -97,7 +99,7 @@ def get_config() -> Config: default_ipa_group=os.environ.get("DEFAULT_IPA_GROUP", "sticknife_users"), app_admin_emails=_csv("APP_ADMIN_EMAILS"), admin_groups=_csv("APP_ADMIN_GROUPS") or {"sticknife_admins"}, - oidc_issuer=os.environ.get("OIDC_ISSUER", "https://auth.sticknife.com/application/o/charon/").rstrip("/"), + oidc_issuer=os.environ.get("OIDC_ISSUER", f"{auth_base_url}/application/o/charon/").rstrip("/"), oidc_client_id=os.environ.get("OIDC_CLIENT_ID", ""), oidc_client_secret=os.environ.get("OIDC_CLIENT_SECRET", ""), oidc_scopes=os.environ.get("OIDC_SCOPES", "openid profile email groups"), diff --git a/app/oidc.py b/app/oidc.py index bca62c7..5aa946f 100644 --- a/app/oidc.py +++ b/app/oidc.py @@ -92,6 +92,6 @@ def groups_from_claims(claims: dict[str, Any]) -> set[str]: def logout_url(config: Config) -> str: provider = discover(config) - endpoint = provider.end_session_endpoint or "https://auth.sticknife.com/if/session-end/" + endpoint = provider.end_session_endpoint or f"{config.auth_base_url}/if/session-end/" query = urllib.parse.urlencode({"post_logout_redirect_uri": config.base_url}) return f"{endpoint}?{query}" diff --git a/app/templates/landing.html b/app/templates/landing.html index aad4e4a..f164e9d 100644 --- a/app/templates/landing.html +++ b/app/templates/landing.html @@ -73,7 +73,7 @@
sticknife.com - accounts and keys — auth.sticknife.com + accounts and keys — charon.sticknife.com
diff --git a/app/templates/pantheon/charon.toml b/app/templates/pantheon/charon.toml index 6514710..02541d1 100644 --- a/app/templates/pantheon/charon.toml +++ b/app/templates/pantheon/charon.toml @@ -7,7 +7,7 @@ name = "Charon" domain = "The Ferryman" state = "here" label = "Live" -host = "auth.sticknife.com" +host = "charon.sticknife.com" runs = "Authentik + FreeIPA" # one line, used by the no-JavaScript listing